CMMC Phase II Is Now Suspended by Regulation. The CUI Clock Isn't.
By Kenio Shirley · · 7 min read
The July suspension was a policy position. The September 9 regulation makes it the law of the contract. That distinction matters for what you can defer — and what you were never allowed to defer in the first place.
On September 9, 2026, the suspension of CMMC Phase II moved from policy memoranda into binding regulation. The Department of War had announced the pause on July 13 with two memos and opened a program review; the regulatory action this week converts that pause from a leadership decision — reversible with a signature — into the rules contracting officers must apply. Washington Technology, CMMC's Phase 2 Suspension Locked In with Binding Regulation Holland & Knight, DOW Suspends CMMC Phase II Requirements
I wrote about the suspension when it was announced. Now that it is codified, it is worth being precise about three things: what actually changed, what never changed, and what the breathing room is for.
What binding suspension changes
A memo tells contracting officers what leadership wants. A regulation tells them what they are permitted to do. The practical consequences:
- Third-party certification requirements leave solicitations durably. Under the memos, a cautious contracting officer could still wave a future Phase II requirement at bidders. Under binding regulation, Level 2 certification clauses come out of new awards until the program review concludes and rulemaking runs again. That is a multi-quarter runway at minimum — rulemaking cycles are measured in seasons, not weeks.
- Primes lose their compliance-deadline leverage argument. The “get certified now or lose your place in our supply chain” pressure flowing down from large primes was always partly anticipatory. The anticipation just got codified away. If a prime is still quoting an imminent Phase II deadline at you, ask them which regulation.
- Budget arguments get honest. “We must certify by Q2 or we lose the contract” is no longer a planning input. The question shifts from when must we to what is it worth — a better question, and one some boards will answer badly.
The suspension relieved contractors of an audit appointment. It did not relieve them of the obligation the audit was going to check. Those are different things, and the difference is where the risk now lives.
What never changed
Every obligation that exists independent of CMMC is exactly where it was on July 12:
- DFARS 252.204-7012 remains in covered contracts. Adequate security on covered contractor systems — NIST SP 800-171, the full 110 requirements — is a present-tense contractual obligation, and has been since 2017. DoD CIO, Cybersecurity Maturity Model Certification
- SPRS self-assessment scores remain required and signed. A Basic self-assessment against 800-171, posted to the Supplier Performance Risk System, is a condition of award under DFARS 252.204-7019/7020. It is also an affirmative representation to the government. An inflated score is not a compliance gap; it is False Claims Act exposure, and DOJ’s Civil Cyber-Fraud Initiative has settled cases on exactly that theory.
- The 72-hour incident reporting clock under 7012 runs regardless of what phase the certification program is in.
In other words: the assessment regime is suspended. The security regime was never touched. If your CUI handling today would fail an 800-171 assessment, the binding regulation has not made you safer — it has made you less likely to discover it on a schedule.
The False Claims Act angle, stated plainly
The risk model under suspension is asymmetric. Before CMMC, the enforcement path for weak 800-171 implementation ran through DOJ cyber-fraud settlements — nine-figure attention-getters against contractors whose SPRS scores did not match reality. CMMC Phase II would have added a second, gentler path: fail a certification, lose eligibility, fix it, come back. Suspending Phase II removes the gentle path and leaves the harsh one. The review the DoD CIO is running could produce “everything from an overhaul to small tweaks,” but nothing in it reduces the representation risk of the SPRS score you posted last quarter. Federal News Network, DoD Plans CMMC Listening Sessions
If you take one action from this article: pull your current SPRS score, re-run the self-assessment against your actual environment — not your POA&M intentions — and reconcile. A score you can defend with evidence is the control underneath everything else.
What the breathing room is for
The contractors I would worry about are treating the suspension as a stand-down. The ones positioned well are treating it as the first window in five years where compliance work is not deadline-shaped, and using it for the things deadlines always crowded out:
- Fix the evidence plumbing, not the paperwork. The most common Phase II failure mode in the pre-suspension assessments was not absent controls — it was controls that could not produce system-generated evidence across the assessment window. Access reviews documented in spreadsheets, change tickets that don’t reconcile to deployments, logs that rotate before the window closes. These are architecture problems with quarters-long lead times. Now is the cheapest they will ever be.
- Shrink the CUI boundary deliberately. Scoping decisions made under deadline pressure tend to be pessimistic and sprawling. A calm review of where CUI actually flows — enclave design, managed service boundaries — can cut the assessment surface, and the run cost, substantially.
- Rebaseline the POA&M against reality. Whatever happens in the program review, SSPs and POA&Ms are not going away. A POA&M that reflects what you will actually close, in what order, on what budget, is a management tool. The alternative is a fiction you will have to explain later.
What to watch next
Two signals matter from here. First, the output of the DoD program review — listening sessions ran through the summer, and the shape of “overhaul versus tweaks” determines whether Phase II returns in its current form or something leaner. Second, the FAR CUI rulemaking track, which proceeds independently of CMMC and will move CUI handling expectations into civilian agency contracts. The certification requirement paused. The CUI diffusion across the federal market did not. Contractors who use this window to build evidence systems rather than shelve the program will find the next version of the requirement — whatever it is called — is mostly already done.